@fjall/components-infrastructure 31.0.0 → 33.0.0

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -4,8 +4,6 @@ export const RDS_DEFAULTS = Object.freeze({
     PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30",
     /** 1 minute — balances monitoring granularity against CloudWatch costs */
     MONITORING_INTERVAL: Duration.minutes(1),
-    /** Default backup retention in days — applied uniformly across Aurora and RDS Instance */
-    BACKUP_RETENTION_DEFAULT_DAYS: 14,
     /** Default instance type — primary and read-replica must stay in lockstep */
     DEFAULT_INSTANCE_TYPE: "t4g.large",
     /** Default storage autoscaling ceiling (GiB) — applied to primary and replica */

package/dist/lib/resources/aws/database/rdsInstance.d.ts

@@ -7,6 +7,7 @@ import { SecurityGroup } from "../networking/securityGroup.js";
 import { Secret } from "../secrets/index.js";
 import { type StackBuilder } from "../base/awsStack.js";
 import { type EngineConfig, type ProxyConfig, type ReadReplicaConfig, type CredentialsConfig, type EncryptionConfig, type DatabaseInsightsConfig, type SnapshotTarget } from "../../../utils/databaseTypes.js";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type RdsAlarmThresholds } from "../monitoring/index.js";
 interface RdsProps {
@@ -17,7 +18,17 @@ interface RdsProps {
     instanceType?: string;
     maxAllocatedStorage?: number;
     allocatedStorage?: number;
+    /**
+     * Automated backup retention. Defaults to the app backup tier's column
+     * (`tierDefault(appBackupTier, "rdsBackupRetentionDays")`).
+     */
     backupRetention?: Duration;
+    /**
+     * The owning app's backup tier (`App.getApp({ backup: { tier } })`), which
+     * the retention default follows. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new RdsInstance(...)` construction.
+     */
+    appBackupTier?: BackupTier;
     preferredBackupWindow?: string;
     clusterIdentifier?: string;
     monitoringInterval?: Duration;

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -8,11 +8,12 @@ import { Construct } from "constructs";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { CustomerManagedKey, Secret } from "../secrets/index.js";
 import { CustomResource } from "../utilities/customResource.js";
-import { getDatabaseInsightsRetention } from "./index.js";
+import { getCdkDatabaseInsightsMode, getDatabaseInsightsRetention } from "./index.js";
 import { RDS_DEFAULTS } from "./rdsDefaults.js";
 import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation, warnIfSnapshotUsernameAssumed } from "./rdsHelpers.js";
 import { resolveSecretRotation, isCMKRequested } from "../../../utils/databaseTypes.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
+import { tierDefault } from "../../../utils/backupTierMapping.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { createRdsAlarms } from "../monitoring/index.js";
 export class RdsInstance extends Construct {
@@ -105,10 +106,15 @@ export class RdsInstance extends Construct {
         const storageEncryptionKey = resolveStorageEncryptionKey(this, this.databaseNameValue, props.encryption?.storageKey);
         const { piEnabled, piConfig } = resolveDatabaseInsights(props.databaseInsights);
         const performanceInsightsEncryptionKey = resolvePerformanceInsightsKey(this, this.databaseNameValue, piEnabled, piConfig?.encryptionKey);
-        const diMode = piConfig?.mode ?? "standard";
+        // The tier owns the Database Insights mode; an explicit `mode` wins.
+        const diMode = piConfig?.mode ??
+            tierDefault(props.appBackupTier, "databaseInsightsMode");
         const performanceInsightsRetention = piEnabled
             ? getDatabaseInsightsRetention(diMode)
             : undefined;
+        // Advanced mode is emitted only when it applies, so a standard template
+        // stays byte-identical (CDK would otherwise infer Performance Insights on).
+        const advancedInsights = piEnabled && diMode === "advanced";
         const engine = props.engine ||
             DatabaseInstanceEngine.postgres({
                 version: PostgresEngineVersion.VER_17_9
@@ -123,7 +129,7 @@ export class RdsInstance extends Construct {
             ? SubnetType.PUBLIC
             : SubnetType.PRIVATE_WITH_EGRESS;
         const backupRetention = props.backupRetention ??
-            Duration.days(RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS);
+            Duration.days(tierDefault(props.appBackupTier, "rdsBackupRetentionDays"));
         // toDays() throws on a fractional Duration — same whole-days contract the
         // L2 DatabaseInstance enforces, surfaced at synth either way.
         this.backupRetentionDaysValue = backupRetention.toDays();
@@ -150,6 +156,9 @@ export class RdsInstance extends Construct {
             enablePerformanceInsights: piEnabled,
             performanceInsightEncryptionKey: performanceInsightsEncryptionKey,
             performanceInsightRetention: performanceInsightsRetention,
+            ...(advancedInsights && {
+                databaseInsightsMode: getCdkDatabaseInsightsMode(diMode)
+            }),
             instanceIdentifier: ResourceNaming.dbInstanceId(this.constructId),
             instanceType: new InstanceType(props.instanceType ?? RDS_DEFAULTS.DEFAULT_INSTANCE_TYPE),
             maxAllocatedStorage: props.maxAllocatedStorage ??
@@ -243,6 +252,9 @@ export class RdsInstance extends Construct {
             props.instanceType ??
             RDS_DEFAULTS.DEFAULT_INSTANCE_TYPE;
         const { piEnabled, piConfig } = resolveDatabaseInsights(props.databaseInsights);
+        const diMode = piConfig?.mode ??
+            tierDefault(props.appBackupTier, "databaseInsightsMode");
+        const advancedInsights = piEnabled && diMode === "advanced";
         const readReplicaPerformanceInsightsKey = piEnabled && isCMKRequested(piConfig?.encryptionKey)
             ? new CustomerManagedKey(this, `${this.databaseNameValue}ReadReplicaReaderInsightsKey`, {
                 aliasName: ResourceNaming.readReplicaInsightsKeyAlias(this.databaseNameValue),
@@ -326,8 +338,11 @@ exports.handler = async (event) => {
             enablePerformanceInsights: piEnabled,
             performanceInsightEncryptionKey: readReplicaPerformanceInsightsKey,
             performanceInsightRetention: piEnabled
-                ? getDatabaseInsightsRetention(piConfig?.mode ?? "standard")
+                ? getDatabaseInsightsRetention(diMode)
                 : undefined,
+            ...(advancedInsights && {
+                databaseInsightsMode: getCdkDatabaseInsightsMode(diMode)
+            }),
             instanceIdentifier: ResourceNaming.readReplicaId(this.constructId),
             instanceType: new InstanceType(replicaInstanceType),
             availabilityZone: replicaConfig.availabilityZone,

package/dist/lib/resources/aws/logging/accessLogBucket.d.ts

@@ -0,0 +1,22 @@
+import type { Construct } from "constructs";
+import { S3Bucket } from "../storage/s3.js";
+/**
+ * How long delivered access logs stay before the lifecycle rule expires
+ * them. Access logs are high-volume and low-value past the incident window;
+ * an unexpired log bucket is the one S3 cost that grows without bound.
+ */
+export declare const ACCESS_LOG_RETENTION_DAYS = 90;
+/**
+ * The one bucket an enterprise-tier stack delivers its access logs to —
+ * application load balancer access logs (`alb/<name>/`) and CloudFront
+ * standard logs (`cloudfront/<id>/`) share it under distinct prefixes.
+ *
+ * Its shape is dictated by the two delivery services and deliberately NOT
+ * tier-aware: ELB log delivery requires SSE-S3 (it cannot write to a
+ * KMS-encrypted bucket), CloudFront standard logging requires ACLs enabled
+ * (`OBJECT_WRITER` ownership, the CDK's own logging-bucket shape), and
+ * versioning would only multiply expired log objects. The bucket takes the
+ * env-aware removal policy like every other bucket: production RETAINs its
+ * audit evidence, non-production DESTROYs.
+ */
+export declare function stackAccessLogBucket(scope: Construct): S3Bucket;

package/dist/lib/resources/aws/logging/accessLogBucket.js

@@ -0,0 +1,41 @@
+import { Duration, Stack } from "aws-cdk-lib";
+import { BucketEncryption, ObjectOwnership } from "aws-cdk-lib/aws-s3";
+import { S3Bucket } from "../storage/s3.js";
+const STACK_ACCESS_LOG_BUCKET_ID = "FjallAccessLogBucket";
+/**
+ * How long delivered access logs stay before the lifecycle rule expires
+ * them. Access logs are high-volume and low-value past the incident window;
+ * an unexpired log bucket is the one S3 cost that grows without bound.
+ */
+export const ACCESS_LOG_RETENTION_DAYS = 90;
+/**
+ * The one bucket an enterprise-tier stack delivers its access logs to —
+ * application load balancer access logs (`alb/<name>/`) and CloudFront
+ * standard logs (`cloudfront/<id>/`) share it under distinct prefixes.
+ *
+ * Its shape is dictated by the two delivery services and deliberately NOT
+ * tier-aware: ELB log delivery requires SSE-S3 (it cannot write to a
+ * KMS-encrypted bucket), CloudFront standard logging requires ACLs enabled
+ * (`OBJECT_WRITER` ownership, the CDK's own logging-bucket shape), and
+ * versioning would only multiply expired log objects. The bucket takes the
+ * env-aware removal policy like every other bucket: production RETAINs its
+ * audit evidence, non-production DESTROYs.
+ */
+export function stackAccessLogBucket(scope) {
+    const stack = Stack.of(scope);
+    const existing = stack.node.tryFindChild(STACK_ACCESS_LOG_BUCKET_ID);
+    if (existing !== undefined)
+        return existing;
+    return new S3Bucket(stack, STACK_ACCESS_LOG_BUCKET_ID, {
+        encryption: BucketEncryption.S3_MANAGED,
+        objectOwnership: ObjectOwnership.OBJECT_WRITER,
+        versioned: false,
+        lifecycleRules: [
+            {
+                id: "ExpireAccessLogs",
+                expiration: Duration.days(ACCESS_LOG_RETENTION_DAYS),
+                enabled: true
+            }
+        ]
+    });
+}

package/dist/lib/resources/aws/logging/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./accessLogBucket.js";
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
 export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/logging/index.js

@@ -1,3 +1,4 @@
+export * from "./accessLogBucket.js";
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
 export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/messaging/sns.d.ts

@@ -2,6 +2,7 @@ import { Construct } from "constructs";
 import { type IKey } from "aws-cdk-lib/aws-kms";
 import { type ITopic } from "aws-cdk-lib/aws-sns";
 import { type IGrantable, type Grant } from "aws-cdk-lib/aws-iam";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import { type RemovalPolicyString } from "./utils.js";
 export interface SNSTopicProps {
     topicName?: string;
@@ -23,11 +24,13 @@ export interface SNSTopicProps {
      */
     signatureVersion?: "1" | "2";
     /**
-     * KMS key for server-side encryption at rest. Absent ⇒ unencrypted — the
-     * accessible default (a customer-managed key costs $1–3/month per
-     * account-region once annual rotation accrues), so the
-     * SNS_TOPIC_NOT_ENCRYPTED posture finding stands
-     * as the signpost to this knob rather than being silently pre-paid.
+     * KMS key for server-side encryption at rest. Absent ⇒ the app backup
+     * tier decides: enterprise encrypts with the stack's shared
+     * [[StackEncryptionKey]] (its SNS service publishers admitted); every other
+     * tier stays unencrypted — the accessible default (a customer-managed key
+     * costs $1–3/month per account-region once annual rotation accrues), so
+     * the SNS_TOPIC_NOT_ENCRYPTED posture finding stands as the signpost to
+     * the tier rather than being silently pre-paid.
      *
      * Every AWS service principal that publishes to the topic needs
      * `kms:Decrypt` + `kms:GenerateDataKey*` on this key's RESOURCE policy or
@@ -35,6 +38,12 @@ export interface SNSTopicProps {
      * used for service publishers precisely because its policy is immutable.
      */
     masterKey?: IKey;
+    /**
+     * The owning app's backup tier, which the encryption default follows.
+     * `MessagingFactory` fills it from the App; pass it only for direct
+     * `new SNSTopic(...)` construction.
+     */
+    appBackupTier?: BackupTier;
 }
 export declare class SNSTopic extends Construct {
     readonly id: string;

package/dist/lib/resources/aws/messaging/sns.js

@@ -1,6 +1,8 @@
 import { Construct } from "constructs";
 import { CfnOutput } from "aws-cdk-lib";
 import { Topic } from "aws-cdk-lib/aws-sns";
+import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { toRemovalPolicy } from "./utils.js";
 export class SNSTopic extends Construct {
     id;
@@ -9,6 +11,10 @@ export class SNSTopic extends Construct {
         super(scope, id);
         this.id = id;
         const isFifo = props.fifo === true;
+        const masterKey = props.masterKey ??
+            (tierDefault(props.appBackupTier, "customerManagedKeys")
+                ? StackEncryptionKey.of(this).forSnsServicePublishers()
+                : undefined);
         const topicName = props.topicName
             ? isFifo
                 ? `${props.topicName}.fifo`
@@ -29,7 +35,7 @@ export class SNSTopic extends Construct {
             // (SharedAlarmTopic carries the cloudwatch.amazonaws.com one).
             // Same-account IAM publishers are unaffected: identity policies suffice.
             enforceSSL: true,
-            masterKey: props.masterKey
+            masterKey
         });
         // An SNS topic is a transient fan-out medium: it holds no durable state
         // (subscriptions are re-created by the next deploy), so the wrapper defaults

package/dist/lib/resources/aws/secrets/index.d.ts

@@ -2,5 +2,6 @@ export * from "./alias.js";
 export * from "./kms.js";
 export * from "./parameter.js";
 export * from "./secret.js";
+export * from "./stackEncryptionKey.js";
 export * from "./tlsCaSecret.js";
 export * from "./tlsServerSecret.js";

package/dist/lib/resources/aws/secrets/index.js

@@ -2,5 +2,6 @@ export * from "./alias.js";
 export * from "./kms.js";
 export * from "./parameter.js";
 export * from "./secret.js";
+export * from "./stackEncryptionKey.js";
 export * from "./tlsCaSecret.js";
 export * from "./tlsServerSecret.js";

package/dist/lib/resources/aws/secrets/stackEncryptionKey.d.ts

@@ -0,0 +1,47 @@
+import type { IKey } from "aws-cdk-lib/aws-kms";
+import type { Construct } from "constructs";
+import { CustomerManagedKey } from "./kms.js";
+/**
+ * The one customer-managed KMS key an enterprise-tier stack encrypts its
+ * tier-owned resources with: DynamoDB tables, SNS topics, Lambda environment
+ * variables, ECS Exec sessions and the log groups the tier-aware constructs
+ * create. One key per stack rather than one per resource — a key is billed
+ * per month whether it protects one table or twenty, its policy is the one
+ * place service principals are admitted, and a posture scan sees one
+ * purposeful key rather than a sprawl of orphans after a destroy.
+ *
+ * `protects: "outlives-stack"`: a DynamoDB table RETAINs by default in every
+ * environment and a production log group RETAINs under D17, so at least one
+ * encrypted resource can survive the stack that created it. A retained key
+ * costs $1–3/month; a destroyed key would render the surviving table
+ * permanently unreadable after its 30-day pending window.
+ *
+ * Grant-based consumers (DynamoDB, Lambda `environmentEncryption`, ECS Exec)
+ * read `key` directly — the SDK/CDK grants they need ride the resource's own
+ * IAM path. Service-side encryptors need a resource-policy admission first:
+ * CloudWatch Logs through [[forLogGroups]], SNS service publishers through
+ * [[forSnsServicePublishers]]. Each admission is added once per stack.
+ */
+export declare class StackEncryptionKey extends CustomerManagedKey {
+    private logsAdmitted;
+    private snsPublishersAdmitted;
+    private constructor();
+    /** The stack's shared key, created on first use. */
+    static of(scope: Construct): StackEncryptionKey;
+    /**
+     * The key, with CloudWatch Logs admitted to it. The CDK `LogGroup` sets
+     * `KmsKeyId` but adds no key-policy statement, and without one the
+     * service cannot encrypt the group and the stack fails to create. The
+     * encryption-context condition confines the admission to log groups in
+     * this account and region (the AWS-documented shape).
+     */
+    forLogGroups(): IKey;
+    /**
+     * The key, with the SNS-publishing AWS services admitted to it
+     * ([[SNS_SERVICE_PUBLISHERS]]). Without the admission their publishes to
+     * an encrypted topic fail silently — the AWS-managed `aws/sns` key cannot
+     * be used for service publishers precisely because its policy is
+     * immutable.
+     */
+    forSnsServicePublishers(): IKey;
+}

package/dist/lib/resources/aws/secrets/stackEncryptionKey.js

@@ -0,0 +1,114 @@
+import { Stack } from "aws-cdk-lib";
+import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { CustomerManagedKey } from "./kms.js";
+const STACK_ENCRYPTION_KEY_ID = "FjallStackEncryptionKey";
+/**
+ * AWS services that publish to an application's SNS topics on the app's
+ * behalf and therefore encrypt messages through the topic's key: EventBridge
+ * rule targets, CloudWatch alarm actions and S3 event notifications. All
+ * three need `kms:Decrypt` + `kms:GenerateDataKey*` on the key's RESOURCE
+ * policy (identity policies cannot admit a service principal), and none of
+ * them can be narrowed with `aws:SourceAccount` / `aws:SourceArn`: EventBridge
+ * does not support the condition keys for encrypted topics, and CloudWatch
+ * does not reliably pass them on this path and fails silently when they do
+ * not match (alarms page nobody) — the SharedAlarmTopic precedent.
+ */
+const SNS_SERVICE_PUBLISHERS = [
+    "events.amazonaws.com",
+    "cloudwatch.amazonaws.com",
+    "s3.amazonaws.com"
+];
+/**
+ * The one customer-managed KMS key an enterprise-tier stack encrypts its
+ * tier-owned resources with: DynamoDB tables, SNS topics, Lambda environment
+ * variables, ECS Exec sessions and the log groups the tier-aware constructs
+ * create. One key per stack rather than one per resource — a key is billed
+ * per month whether it protects one table or twenty, its policy is the one
+ * place service principals are admitted, and a posture scan sees one
+ * purposeful key rather than a sprawl of orphans after a destroy.
+ *
+ * `protects: "outlives-stack"`: a DynamoDB table RETAINs by default in every
+ * environment and a production log group RETAINs under D17, so at least one
+ * encrypted resource can survive the stack that created it. A retained key
+ * costs $1–3/month; a destroyed key would render the surviving table
+ * permanently unreadable after its 30-day pending window.
+ *
+ * Grant-based consumers (DynamoDB, Lambda `environmentEncryption`, ECS Exec)
+ * read `key` directly — the SDK/CDK grants they need ride the resource's own
+ * IAM path. Service-side encryptors need a resource-policy admission first:
+ * CloudWatch Logs through [[forLogGroups]], SNS service publishers through
+ * [[forSnsServicePublishers]]. Each admission is added once per stack.
+ */
+export class StackEncryptionKey extends CustomerManagedKey {
+    logsAdmitted = false;
+    snsPublishersAdmitted = false;
+    constructor(stack) {
+        super(stack, STACK_ENCRYPTION_KEY_ID, {
+            description: `Encrypts the enterprise-tier resources of ${stack.stackName} (DynamoDB tables, SNS topics, Lambda environment, ECS Exec sessions, log groups)`,
+            // KMS alias names are unique per account-region, so the stack name is
+            // the namespace — every stack in the account carries its own key.
+            aliasName: `cmk/${stack.stackName}/${STACK_ENCRYPTION_KEY_ID}`,
+            protects: "outlives-stack"
+        });
+    }
+    /** The stack's shared key, created on first use. */
+    static of(scope) {
+        const stack = Stack.of(scope);
+        const existing = stack.node.tryFindChild(STACK_ENCRYPTION_KEY_ID);
+        if (existing !== undefined)
+            return existing;
+        return new StackEncryptionKey(stack);
+    }
+    /**
+     * The key, with CloudWatch Logs admitted to it. The CDK `LogGroup` sets
+     * `KmsKeyId` but adds no key-policy statement, and without one the
+     * service cannot encrypt the group and the stack fails to create. The
+     * encryption-context condition confines the admission to log groups in
+     * this account and region (the AWS-documented shape).
+     */
+    forLogGroups() {
+        if (!this.logsAdmitted) {
+            const stack = Stack.of(this);
+            this.key.addToResourcePolicy(new PolicyStatement({
+                sid: "AllowCloudWatchLogs",
+                principals: [
+                    new ServicePrincipal(`logs.${stack.region}.amazonaws.com`)
+                ],
+                actions: [
+                    "kms:Encrypt*",
+                    "kms:Decrypt*",
+                    "kms:ReEncrypt*",
+                    "kms:GenerateDataKey*",
+                    "kms:Describe*"
+                ],
+                resources: ["*"],
+                conditions: {
+                    ArnLike: {
+                        "kms:EncryptionContext:aws:logs:arn": `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:*`
+                    }
+                }
+            }));
+            this.logsAdmitted = true;
+        }
+        return this.key;
+    }
+    /**
+     * The key, with the SNS-publishing AWS services admitted to it
+     * ([[SNS_SERVICE_PUBLISHERS]]). Without the admission their publishes to
+     * an encrypted topic fail silently — the AWS-managed `aws/sns` key cannot
+     * be used for service publishers precisely because its policy is
+     * immutable.
+     */
+    forSnsServicePublishers() {
+        if (!this.snsPublishersAdmitted) {
+            this.key.addToResourcePolicy(new PolicyStatement({
+                sid: "AllowSnsServicePublishers",
+                principals: SNS_SERVICE_PUBLISHERS.map((service) => new ServicePrincipal(service)),
+                actions: ["kms:Decrypt", "kms:GenerateDataKey*"],
+                resources: ["*"]
+            }));
+            this.snsPublishersAdmitted = true;
+        }
+        return this.key;
+    }
+}

package/dist/lib/utils/backupTierMapping.d.ts

@@ -1,7 +1,15 @@
+import { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, type BackupTier, type BackupTierDefaults, tierDefault } from "@fjall/util";
 /** Tag key used by AWS Backup plan selection rules */
 export declare const BACKUP_TIER_TAG_KEY = "fjall:disasterRecovery:tier";
-/** Valid backup tier names */
-export type BackupTier = "standard" | "resilient" | "enterprise";
+/**
+ * The application backup tier vocabulary and its defaults table are owned by
+ * `@fjall/util` (`BACKUP_TIERS`, `BACKUP_TIER_DEFAULTS`, `tierDefault`) and
+ * shared with the generator (`BACKUP_VAULT_TIERS`) and the CLI's synth
+ * expectations, so every system derives from one declaration. Re-exported
+ * here so construct code keeps one import path for tier concerns.
+ */
+export type { BackupTier, BackupTierDefaults };
+export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, tierDefault };
 /**
  * Shared mapping from application backup tier names to AWS Backup plan tag values.
  *

package/dist/lib/utils/backupTierMapping.js

@@ -1,5 +1,7 @@
+import { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, tierDefault } from "@fjall/util";
 /** Tag key used by AWS Backup plan selection rules */
 export const BACKUP_TIER_TAG_KEY = "fjall:disasterRecovery:tier";
+export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, tierDefault };
 /**
  * Shared mapping from application backup tier names to AWS Backup plan tag values.
  *
@@ -22,5 +24,5 @@ export function resolveEffectiveBackupTier(resourceTier, appTier) {
 }
 /** Tiers whose S3 buckets version by default. */
 export function shouldAutoVersion(tier) {
-    return tier === "resilient" || tier === "enterprise";
+    return tierDefault(tier, "s3Versioned");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "31.0.0",
+  "version": "33.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -39,7 +39,7 @@
     "clean": "rm -rf ./dist",
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
-    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs && node ../../scripts/stamp-build.mjs",
+    "build": "npm run clean && npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs && node ../../scripts/stamp-build.mjs",
     "prepack": "node ../../scripts/check-dist-freshness.mjs",
     "watch": "tsc -w",
     "watch:only": "tsc -w",
@@ -78,8 +78,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^31.0.0",
-    "@fjall/util": "^31.0.0",
+    "@fjall/generator": "^33.0.0",
+    "@fjall/util": "^33.0.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },